systemprompt-oauth 0.45.0

OAuth 2.0 / OIDC with PKCE, token introspection, and audience/issuer validation for systemprompt.io AI governance infrastructure. WebAuthn and JWT auth for the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177

<div align="center">

<picture>
  <source media="(prefers-color-scheme: dark)" srcset="https://systemprompt.io/files/images/logo.svg">
  <source media="(prefers-color-scheme: light)" srcset="https://systemprompt.io/files/images/logo-dark.svg">
  <img src="https://systemprompt.io/files/images/logo.svg" alt="systemprompt.io" width="180">
</picture>

### Production infrastructure for AI agents

[**Website**](https://systemprompt.io) · [**Documentation**](https://systemprompt.io/documentation/) · [**Guides**](https://systemprompt.io/guides) · [**Core**](https://github.com/systempromptio/systemprompt-core) · [**Template**](https://github.com/systempromptio/systemprompt-template) · [**Discord**](https://discord.gg/wkAbSuPWpr)

</div>

---

# systemprompt-oauth

<div align="center">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/systempromptio/systemprompt-core/main/assets/readme/terminals/dark/domain-oauth.svg">
    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/systempromptio/systemprompt-core/main/assets/readme/terminals/light/domain-oauth.svg">
    <img alt="systemprompt-oauth terminal demo" src="https://raw.githubusercontent.com/systempromptio/systemprompt-core/main/assets/readme/terminals/dark/domain-oauth.svg" width="100%">
  </picture>
</div>

[![Crates.io](https://img.shields.io/crates/v/systemprompt-oauth.svg?style=flat-square)](https://crates.io/crates/systemprompt-oauth)
[![Docs.rs](https://img.shields.io/docsrs/systemprompt-oauth?style=flat-square)](https://docs.rs/systemprompt-oauth)
[![License: BSL-1.1](https://img.shields.io/badge/license-BSL--1.1-2b6cb0?style=flat-square)](https://github.com/systempromptio/systemprompt-core/blob/main/LICENSE)
[![codecov](https://img.shields.io/codecov/c/github/systempromptio/systemprompt-core/main?style=flat-square&logo=codecov)](https://codecov.io/gh/systempromptio/systemprompt-core)

Your own authorization server, not a rented identity provider. OAuth 2.0 and OIDC with PKCE, dynamic client registration, token introspection and revocation, and WebAuthn passwordless login, all running in your binary against your PostgreSQL.

**Layer**: Domain — business-logic modules that implement systemprompt.io features. Part of the [systemprompt-core](https://github.com/systempromptio/systemprompt-core) workspace.

## Overview

**Capabilities** · [Compliance](https://systemprompt.io/features/compliance)

This crate implements a complete OAuth 2.0 authorization server with:

- Authorization Code Grant with PKCE
- Client Credentials Grant
- Refresh Token Grant
- Token Exchange (RFC 8693) and the JWT Bearer assertion grant (RFC 7523)
- MCP Enterprise-Managed Authorization: ID-JAG issuance and redemption, with single-use replay protection
- Dynamic Client Registration (RFC 7591)
- Token Introspection (RFC 7662)
- Token Revocation (RFC 7009)
- WebAuthn/FIDO2 Passwordless Authentication
- OpenID Connect Discovery

## Usage

```toml
[dependencies]
systemprompt-oauth = "0.45"
```

```rust
use systemprompt_oauth::{
    OAuthRepository, OAuthState, OauthError, OauthExtension, OauthResult,
    SessionCreationService, TokenValidator, validate_jwt_token,
};
use systemprompt_oauth::services::{
    issue_bridge_access, issue_bridge_exchange_code, exchange_bridge_session_code,
};
```

## Module Layout

| Module | Purpose |
|--------|---------|
| `models/` | OAuth client, token, and JWT-claim types, CIMD metadata, analytics, and typed grant/response/PKCE enums. |
| `queries/` | Compile-time-verified `sqlx` query layer: `postgres/` analytics queries and `seed/` WebAuthn client seeds. |
| `repository/` | Data access for clients, OAuth protocol records, bridge sessions and host prefs, exchange codes, setup tokens, and WebAuthn credentials. |
| `services/` | OAuth business logic: `bridge`, `cimd`, `generation`, `jwt`, `session`, `validation`, `webauthn`, `plugin_token`, `providers`, `templating`, and HTTP helpers. |

### models/
Data structures for OAuth clients, tokens, JWT claims, CIMD metadata, and analytics. Includes typed enums for grant types, response types, and PKCE methods.

### queries/
PostgreSQL query implementations using compile-time-verified `sqlx` macros, plus `queries/seed/` SQL for seeding the WebAuthn client and its scopes.

### repository/
Data access layer with separate repositories for clients (`ClientRepository`), OAuth protocol records (`OAuthRepository`), bridge sessions (`BridgeSessionRepository`), bridge host preferences (`BridgeHostPrefsRepository`), exchange codes, setup tokens, and WebAuthn credentials.

### services/
Business logic including:
- **bridge**: Bridge access-token issuance and short-lived exchange codes for the desktop bridge.
- **cimd**: Client-Initiated Metadata Discovery fetcher and validator.
- **generation**: Secure token, JWT, and client-secret generation.
- **jwt**: `TokenValidator` and `AuthService` for token authentication and authorisation.
- **plugin_token**: `PluginTokenService` mints long-lived plugin-scoped JWTs (`aud=hook`) for hook/governance plugin credentials.
- **providers**: `JwtValidationProviderImpl` implementing the `JwtValidationProvider` trait.
- **session**: Anonymous and authenticated session creation and lookup.
- **templating**: HTML template rendering for the OAuth consent / login pages.
- **validation**: Audience, client-credential, JWT, redirect-URI, and OAuth-parameter validation.
- **webauthn**: FIDO2 passwordless authentication, registration, and account linking.

## Database Tables

| Table | Purpose |
|-------|---------|
| `oauth_clients` | Registered OAuth clients |
| `oauth_client_redirect_uris` | Allowed redirect URIs per client |
| `oauth_client_grant_types` | Supported grant types per client |
| `oauth_client_response_types` | Supported response types per client |
| `oauth_client_scopes` | Allowed scopes per client |
| `oauth_client_contacts` | Contact emails per client |
| `oauth_auth_codes` | Authorization codes (600s TTL) |
| `oauth_refresh_tokens` | Refresh tokens |
| `oauth_state_bindings` | OAuth state-to-session bindings |
| `oauth_jti_revocations` | Revoked JWT identifiers |
| `bridge_exchange_codes` | Short-lived bridge session exchange codes |
| `bridge_sessions` | Bridge heartbeat / active-session records |
| `bridge_user_host_prefs` | Per-user, per-host bridge enable/disable preferences |
| `bridge_user_host_model_prefs` | Per-user, per-host model preferences |
| `id_jag_replay` | ID-JAG token replay protection |
| `webauthn_setup_tokens` | Bootstrap and admin setup tokens |
| `webauthn_credentials` | FIDO2 / WebAuthn credentials |
| `webauthn_challenges` | WebAuthn challenge storage |

## Trait Implementations

Implements traits from `systemprompt-traits`:

| Trait | Implementation | Purpose |
|-------|----------------|---------|
| `JwtValidationProvider` | `JwtValidationProviderImpl` | Token validation |
| `UserProvider` | Consumed via `Arc<dyn UserProvider>` | User lookup |

## Dependencies

### Internal Crates
- `systemprompt-config` — Profile and config loading
- `systemprompt-database` — `DbPool` and SQLx abstraction
- `systemprompt-extension` — Extension framework
- `systemprompt-logging` — Tracing setup
- `systemprompt-security` — Crypto and auth primitives

### Shared Crates
- `systemprompt-traits` — Auth and provider traits
- `systemprompt-models` — Shared domain types
- `systemprompt-identifiers` — Typed identifiers (with `sqlx` feature)

### External
- `jsonwebtoken` — JWT encoding / decoding
- `bcrypt` — Password and secret hashing
- `webauthn-rs` — FIDO2 / WebAuthn
- `axum`, `http`, `reqwest` — HTTP server and client types
- `sqlx` — Compile-time-verified PostgreSQL queries
- `validator`, `rand`, `base64`, `sha2` — Validation and crypto helpers

## Security Features

- PKCE required for authorization code flow
- S256 challenge method enforced (plain disallowed)
- Entropy validation for code challenges
- Constant-time client secret comparison
- Secure cookie attributes (HttpOnly, Secure, SameSite)
- Token revocation support
- WebAuthn for passwordless authentication

## License

BSL-1.1 (Business Source License). Source-available for evaluation, testing, and non-production use. Production use requires a commercial license. Each version converts to Apache 2.0 four years after publication. See [LICENSE](https://github.com/systempromptio/systemprompt-core/blob/main/LICENSE).

---

<div align="center">

**[systemprompt.io](https://systemprompt.io)** · **[Documentation](https://systemprompt.io/documentation/)** · **[Guides](https://systemprompt.io/guides)** · **[Live Demo](https://systemprompt.io/features/demo)** · **[Template](https://github.com/systempromptio/systemprompt-template)** · **[crates.io](https://crates.io/crates/systemprompt-oauth)** · **[docs.rs](https://docs.rs/systemprompt-oauth)** · **[Discord](https://discord.gg/wkAbSuPWpr)**

<sub>Domain layer · Own how your organization uses AI.</sub>

</div>